CVE Intelligence
Analysis AI-assisted

CVE-2026-48276: Adobe ColdFusion Unrestricted File Upload Leading to Arbitrary Code Execution

CVE-2026-48276 is a critical Unrestricted Upload of File with Dangerous Type (CWE-434) issue in Adobe ColdFusion, according to the CNA record. The description states it could allow arbitrary code execution in the context of the current user, without user interaction and with a changed scope. The record gives no fixed versions and no confirmed exploitation, so administrators should check the vendor advisory and apply it as soon as it is available.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Adobe published advisory APSB26-68 for ColdFusion, which is cited for CVE-2026-48276. The record classifies the flaw as CWE-434, Unrestricted Upload of File with Dangerous Type. The description says it could allow arbitrary code execution in the context of the current user.

Impact

  • The CNA assigns a Critical severity with a CVSS 3.1 base score of 10.0.
  • The vector indicates network attack, low complexity, no privileges required, no user interaction, and a changed scope.
  • The vector rates confidentiality, integrity and availability impact as high.
  • A successful attack could let an attacker run code with the privileges of the ColdFusion user context, which may reach data and services beyond the application itself.

Affected products and versions

  • The description names ColdFusion versions 2025.9, 2023.20 and earlier.
  • The structured list in the record includes multiple 2023 and 2025 update-level entries for Adobe ColdFusion.
  • The record does not list fixed versions. A missing fixed version in the record does not mean no fix exists; check the vendor advisory.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • No confirmed exploitation appears in the sources consulted.
  • The EPSS probability is 0.0126 (about 1.26 percent) with a percentile of 0.68862 in the record. This is a statistical estimate, not evidence of attacks.

Remediation and mitigation

  • Identify all ColdFusion installations, including older 2023 and 2025 update levels, and compare them with the vendor advisory.
  • Apply the vendor fix as soon as it is confirmed for your version. Because the record does not provide fixed versions, verify the fix in the advisory.
  • Until patching is complete, restrict who can reach administrative and upload functionality, and limit network exposure of ColdFusion services.
  • Review file upload handling and storage locations so that uploaded content cannot be executed by the server.

Detection guidance

  • Review web server and application logs for unexpected file creation or new file types in upload and web-accessible directories.
  • Monitor for unusual processes started by the ColdFusion service account.
  • Alert on unexpected changes to ColdFusion configuration and application files.

Limitations of the available information

  • The record does not include a fixed version list, so the exact patched builds are unknown.
  • The title was not provided in the record and was written from the CWE and description.
  • The record does not include exploit details, public proof of concept information, or vendor-confirmed exploitation.
  • Only the NVD, CVE.org and vendor advisory references in the record were used.

Frequently asked questions

Is CVE-2026-48276 known to be actively exploited?

The CISA KEV catalog does not list it in the record, and no confirmed exploitation appears in the sources consulted.

Which ColdFusion versions are affected?

The description names ColdFusion 2025.9, 2023.20 and earlier. The record also includes several 2023 and 2025 update-level entries.

Is there a fixed version in the record?

No. The record does not list fixed versions, so check the Adobe advisory APSB26-68 for patch details.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.